Authentik LDAP Outpost Operator

Learn about configurations >

• base_dn | string

  Default: dc=ldap,dc=goauthentik,dc=io

  Base DN under which LDAP objects are accessible.

• bind_mode | string

  Default: cached

  LDAP bind mode: direct or cached.

• cpu | string

  K8s cpu resource limit, e.g. "1" or "500m". Default is unset (no limit). This value is used for the "limits" portion of the resource requirements (the "requests" portion is automatically deduced from it). See https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/

• expose_ldap_ingress | boolean

  Enable exposing the plain LDAP endpoint (Port 389/3389) via Traefik.

  WARNING: Plain LDAP does not encrypt connection traffic. Use this option only if your Traefik instance is internal/private and your legacy clients do not support LDAPS.

  Note: Since cleartext TCP traffic lacks TLS/SNI, Traefik routes this via HostSNI(*). If multiple charms/outposts try to enable this on the same Traefik instance, a port/routing conflict will occur.

• http_proxy | string

  URL of the HTTP proxy eg http://proxy.internal:6666, it will set the HTTP_PROXY var in the workload environment

• https_proxy | string

  URL of the HTTPS proxy eg http://proxy.internal:6666, it will set the HTTPS_PROXY var in the workload environment

• ingress_domain | string

  The custom domain name to use for the external ingress route (e.g. "outpost.example.com"). If unset, the route rule defaults to "HostSNI(*)" to match all incoming TLS traffic on port 636.

• log_level | string

  Default: info

  Configures the log level.

  Acceptable values are: "info", "debug", "warning", "error" and "critical"

• memory | string

  K8s memory resource limit, e.g. "1Gi". Default is unset (no limit). This value is used for the "limits" portion of the resource requirements (the "requests" portion is automatically deduced from it). See https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/

• mfa_support | boolean

  Enable/disable multi-factor authentication support via password-appending.

• no_proxy | string

  Domains that need to be excluded from proxying no_proxy="test.com,test.co.uk", it is a comma separate list

• search_mode | string

  Default: cached

  LDAP search mode: direct or cached.